Privacy notice

1. In short

• We collect only what we need to run a trustworthy membership.
• The document proving you are a physical therapist is seen only by our administrators, every view is logged, and it is deleted as soon as your application is accepted or refused.
• We never sell your data or use it for advertising.
• You can see, correct or delete your data at any time.

This notice explains how Streak PT ("we") handles personal data for membership accounts, in line with Egypt's Personal Data Protection Law (Law No. 151 of 2020). It should be read with our terms and conditions.

2. What we collect and why

Data	Why we need it
Full name, date of birth	To identify you, check you meet the minimum age, and match the name on your proof of profession during review.
Email address	To sign you in, confirm the address is yours, and send account messages (decisions, password resets, security notices).
Mobile number	To contact you about your membership, registrations and events when email is not enough.
Profile photo	To identify you during review and on your membership card.
Proof-of-profession document image and type	Only to confirm that you are a physical therapist or PT student. See section 3.
Password	To protect your account. We store only a salted one-way hash, never the password itself.
Agreement record	The version and date of the terms you accepted.
Security data	IP address, browser type and the time of sign-ins and key account actions, to prevent abuse and investigate misuse.

We process this data to provide the membership you asked for, on the basis of your consent (given when you apply, and separately for your proof-of-profession document), and to protect the service and its members.

3. Your proof of profession

Membership is for physical therapists and PT students, so we ask for one document that shows you belong to the profession (a syndicate card, licence to practise, PT degree certificate or PT student card). This is not a government identity check: we never ask for your national ID or passport. Professional documents still contain personal data, so we handle them with extra care:

1. Cleaned before upload. Your browser re-creates the image before sending it, removing hidden details such as GPS location and camera information. Our server removes any that remain.
2. Stored privately. The image is kept in private, encrypted cloud storage that is not reachable from the internet. It can only be opened through our staff area.
3. Strictly limited access. Only administrators and owners, signed in with a password and a second factor, can open it. Each time it is opened, who opened it and when is written to our security log.
4. Deleted on decision. When your application is accepted, the image is deleted permanently. If it is refused, your whole application, including the photo and the document, is deleted.
5. Never used for anything else. We don't copy, share or keep any numbers on the document, and we never use the image for any other purpose.

4. Who processes your data

We don't sell or rent personal data. We use a small number of service providers who process it on our behalf and only for these purposes:

• Cloudflare: hosting, database, private file storage, and the bot check on our forms (Turnstile).
• Resend: delivery of account emails.
• Have I Been Pwned: to check whether a new password has appeared in a known breach. Only the first five characters of a one-way hash of the password are sent, never the password.

Some of these providers may process data outside Egypt; we choose providers with strong security and contractual safeguards. We may disclose data if required by law.

5. How long we keep it

• Proof-of-profession image: until your application is accepted or refused, then deleted.
• Applications that are not approved: deleted when the decision is made.
• Applications whose email is never confirmed: deleted automatically after 7 days, with the photo and document.
• Your account: for as long as you keep it. When you delete it, your profile, photo and credentials are erased immediately.
• Security log: a minimal record of key events (for example, that an application was reviewed or an account deleted, with the email address involved) is kept for as long as needed to protect the service and investigate misuse.

6. How we protect it

• All traffic is encrypted (HTTPS); sessions use secure, HTTP-only cookies.
• Passwords are hashed; breached passwords are refused; repeated failed sign-ins are locked out.
• Every form is protected against automated abuse.
• Staff access requires two-step sign-in and every sensitive action is logged.

No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the competent authority as the law requires.

7. Your rights

You have the right to:

• know what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted. You can do this yourself at any time from My account;
• withdraw your consent. Withdrawing consent to the profession check before a decision means we cannot complete your application, and we will delete it;
• object to processing, and to complain to Egypt's Personal Data Protection Centre.

To use any of these rights, email us from the address on your account. We reply within 30 days.

8. Cookies

The member area uses one essential, secure cookie to keep you signed in. It is not used for tracking or advertising. Cloudflare Turnstile may use technical signals to tell people from bots when you submit a form.

9. Contact and complaints

Questions or requests about your data: streak.physicaltherapy@gmail.com. If you are not satisfied with our reply, you may complain to the Personal Data Protection Centre in Egypt.